Security wants an immediate alert whenever the AWS account's ROOT user is used for any API call. Which pattern delivers this?
A.Daily IAM credential report review
Daily review is days too late.
B.EventBridge rule matching CloudTrail events where userIdentity.type = "Root" → SNS notification
Correct. Real-time event matching on API calls.
C.An SCP denying root actions
SCPs can't restrict the root user.
D.Config rule checking root MFA weekly
MFA checks don't alert on usage.
Why this answer
CloudTrail logs every API call including root; an EventBridge rule matching root identity events fires instantly to SNS/SSM — the standard root-usage alarm. Credential reports and periodic checks are too slow for an event that should never happen.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Operations practice session.
Practice Security Operations